3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-46653

CVE-2025-46653: Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content

Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-46653

CVE-2025-46653:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
formidable	npm	>= 3.1.1-canary.20211030, < 3.5.3	3.5.3
formidable	npm	>= 2.1.0, < 2.1.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description clearly states that Formidable relied on hexoid for generating filenames and that hexoid is not cryptographically secure. I analyzed two provided commits (022c2c5577dfe14d2947f10909d81b03b6070bf5 and 37a3e89fca1ed68ec674a539f13aafd62221ddaa) which both patch this vulnerability. Both commits modify the src/Formidable.js file.

In this file, the IncomingForm class has a method (assigned as a property in the constructor or as a class method, effectively _getNewName) that was responsible for generating new filenames. The patches show that the call to toHexoId() (which was initialized using hexoid) within _getNewName was replaced by a call to createId() (which uses @paralleldrive/cuid2, a more secure alternative).

This directly points to IncomingForm._getNewName as the function that contained the vulnerable code (the use of hexoid for filename generation). The purpose of this function aligns perfectly with the vulnerability description. The patch directly replaces the insecure call within this function, confirming it as the site of the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.